Switch Address Restriction Engine for Early Traffic Filtering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network filtering mechanisms consume significant resources and complicate decision-making by processing packets from clients without IP addresses, raising security issues due to unnecessary packet forwarding until the routing phase.
Innovation Solution
A system with an address restriction engine that determines whether data units have layer 3 address assignments, enabling or disabling the address assignment status restriction attribute based on recorded layer 2 client-identification data, allowing or rejecting non-DHCP packets and improving switch performance by blocking unwanted traffic early in the forwarding process.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If ACL configuration is used to filter packets from clients without IP addresses, then network security is improved, but network resource consumption increases and device complexity increases
Solution Approach 1:
The patent applies preliminary action by checking whether a client has obtained an IP address before the routing phase. The switch examines the packet flow and determines if the source MAC address corresponds to a client that has received IP address assignment. This preliminary check allows the network to filter out packets from clients without IP addresses early in the forwarding process, avoiding the need to process these packets through subsequent routing and ACL checking stages, thereby reducing network resource consumption while maintaining security.
2Reliability
If ACL configuration is used to filter packets, then network security is improved, but decision-making complexity increases
Solution Approach 1:
The patent simplifies decision-making by performing the IP address assignment status check before routing decisions. The switch maintains a mapping between MAC addresses and IP address assignment status, allowing it to make simple binary decisions (forward or drop) based on whether the client has obtained an IP address. This preliminary determination eliminates the need for complex ACL rule evaluation for packets from clients without IP addresses, reducing decision-making complexity while maintaining security.
3Adaptability or versatility
If packets are forwarded until the routing phase, then network adaptability is maintained, but resource consumption increases
Solution Approach 1:
The patent applies preliminary action by determining IP address assignment status early in the packet forwarding process, before the routing phase. The switch checks whether the source MAC address corresponds to a client that has obtained an IP address and makes a forwarding decision based on this information. This early determination allows the network to drop packets from clients without IP addresses before they consume additional network resources in routing and higher-layer processing stages, thereby reducing resource consumption while maintaining network adaptability for legitimate traffic.
Data Source
AI summary
This specification describes a system that can offer, among other advantages, dynamically allowing or rejecting non-DHCP packets entering a switch. In addition, a FDB is commonly used by a bridge or switch to store an incoming packet's source MAC address and its port number, then later on if the destination MAC address of another incoming packet matching any entry in FDB will be forwarded to its associated port. Using the techniques described herein, not only this will be completely transparent to user, the techniques can also result in an increase in switch performance by blocking unwanted traffic at an earlier stage of forwarding process and freeing up other processing units at a later stage, like switch fabric or packet processing stages.